topic Re: How to filter syslog messages in Smartlog in General Topics

How to filter syslog messages in Smartlog

peter_schumache — Sat, 09 Nov 2019 11:39:02 GMT

I configured my gateway to send its syslog messages to the SmartCenter Server according to sk102995.

To view the syslog messages in Smrtview Tracker, is says:

"In SmartView Tracker log, the informational field will should show "...system daemons syslog_severity..."

There is no way to define a query (in R80.20) for the "informational" Field. There is a field "Information", but again, no query available.

What did I miss?

Re: How to filter syslog messages in Smartlog

FedericoMeiners — Sat, 09 Nov 2019 12:13:03 GMT

How did you set this up? It seems that you made it the old way

On GWs R80.X you can go to the System Logging (Gateway, not management) section on the web user interface, once there you will find a check box to send syslog messages to the management server. Page 190 from admin guide:

https://dl3.checkpoint.com/paid/8d/8dbd7585030bbad76a1e65c3b458f74c/CP_R80.10_Gaia_AdminGuide.pdf?HashKey=1573308551_f3ebcc1f850da0949464ce4b49be105a&xtn=.pdf

After doing this try some failed and valid log ins to the configured gateway check the logs.

Hope it helps!

___

Re: How to filter syslog messages in Smartlog

peter_schumache — Sat, 09 Nov 2019 13:19:03 GMT

I did it the new way, saying "send syslogs to SmartCenter".

The problem lies in prooving it. How can I display in Smartlog ONLY the messages from syslog?

Re: How to filter syslog messages in Smartlog

D_W — Tue, 12 Nov 2019 15:45:42 GMT

Try to add "blade:syslog" in the query.